Practical Python for glue, automation, and protocol work — standard library first.
17 posts
A hands-on guide to running commands from Python safely: why a list beats shell=True, a real shell injection demo with shlex.quote, check=True, capture_output, timeout, and env and cwd. Every block actually run.
SQLite's JSON1 extension lets you query, filter, and index JSON stored in a TEXT column — json_extract, ->>, json_each, and the generated-column trick that makes it fast.
Forward-simulating the optics behind glass-bead 3D pictures: a per-pixel GPU shader ray tracer for a glass bead lens array, thin-lens deflection vs Snell's law refraction, why moiré magnification and parallax appear, the Qt+moderngl context trap, and inverse design that prints a 3D model.
A SQLite file that grows and never shrinks is the freelist. See real before/after numbers for page_count, freelist_count, VACUUM, auto_vacuum, incremental_vacuum, VACUUM INTO, and integrity_check vs quick_check.
A practical guide to SQLite locking with real experiments: why the default rollback journal returns "database is locked" (SQLITE_BUSY), how WAL mode lets readers run during a write, and the one-writer rule, with busy_timeout and synchronous trade-offs and real timings.
Hands-on packet manipulation in Python: craft packets with Scapy — a crafted ICMP echo, an Ethernet/IP/TCP frame, a real DNS query — send them on your own loopback, and sniff the replies. Real show(), hexdump() and resolver output, plus the honest limits.
SQLite FTS5 in practice: full-text search in one file. Real sqlite3 output — creating the index (standalone and external content), MATCH queries, bm25() ranking versus LIKE, highlight() and snippet(), the unicode61, porter and trigram tokenizers, maintenance, and the honest limits.
Real measured timings showing how blocking calls, sequential awaits, un-awaited coroutines, and CPU-bound work silently kill your asyncio performance — and how to fix each one.
How I hunt a Python memory leak without guessing: build a reproducer, read RSS from /proc, diff tracemalloc snapshots to name the growing allocation, walk gc.get_referrers to find who holds it, then prove the fix with the same numbers.
I built a tiny Model Context Protocol server in Python stdlib and drove it by hand over stdio. Real JSON-RPC frames for initialize, tools/list, and tools/call — plus the architecture, tool schemas, security boundaries, and where an MCP server honestly beats plain function calling.
I built a tiny retrieval system over this blog's own posts — SQLite, 256-dim embeddings, BM25, RRF — and pasted the real output. Three queries, one that fails completely. What RAG actually is, why chunking and retrieval quality dominate everything, and when you do not need RAG at all.
WebSocket or Server-Sent Events? I put a throwaway echo server and an events endpoint behind nginx, captured the real 101 handshake, the text/event-stream frames, reconnection with Last-Event-ID, and the buffering trap — then turned it into a decision list.
XSS and CSRF for backend engineers: the three flavours of XSS, why context-aware output encoding beats a generic escape(), Content-Security-Policy as defence in depth, why cookies make you vulnerable to CSRF, SameSite cookie behaviour, CSRF tokens, and why an XSS defeats them.
One counter per IP is not rate limiting. A practical guide to what you are actually protecting, why fixed and sliding windows fail, how a token bucket handles bursts, where to enforce, how to rate limit without Redis, and how to return an honest 429 with Retry-After.
The idempotency key pattern, learned the hard way: double charges, duplicate records, and the retry-safety bug behind them. Why networks force retries, how at-least-once delivery makes exactly-once impossible, and a server-side implementation that replays stored results and survives concurrency.
A stdlib-only Python pcap parser you can read in one sitting: the global header and packet records, byte order and snaplen, when scapy or dpkt wins and when hand-parsing does, Ethernet → IPv4 → TCP 5-tuples, a pcapng primer, and streaming performance notes.
How I reverse-engineered a Ruijie ePortal captive portal and its CAS single sign-on flow to build a headless Python auto-login daemon that reconnects a campus uplink in about 16 seconds.